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(57) Abstract: A cracker monitoring system has a simplified system configuration for automatically detecting the attacks of a LAN 
(1) by crackers so that the LAN (1) can be protected from crackers with minimum restrictions of communication without the need 
for skilled personnel. A sensor (5) is provided at the entrance to the LAN (1) to detect every IP packet passing therethrough. The 
sensor (5) uses the IP packets to detect various attacks of the LAN (1) by crackers. The information on the attacks detected by the 
sensor (5) is provided for a director (6) that controls a firewall (2). The director (6) controls the firewall (2) according to the provide 
information to stop unwelcome IP packets from entering the LAN (1). 
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S¥^O^fg^Wt-Sx'f^^^6 **Sstt$nTViS. ^n&coir >+!■ 

So 

ffl IB -fe>1f- 5 HW^aUN I X7y>Hi D$f$;£ft, -f-it^-y h 
H 7 &^LTtulHA^4 ttiSnt^S, t>1t5l: 
tt, tcpduraptl^n5V7h7i7^8SnT^5. H<Z> t 
cpdumplI^T, A^4fta5iTO I P/^y ht-f-^V 
h*-F7§^btK#t5 (t7U>^t5) ^t^T-^So 
?&t!jf£&, 7°P5X ■ ^tX 1 ^-F (promise cast mode) £ V> 



WO 01/13589 r*. l/Jt-uu/uwooy 

2 5 

>rv hfc«*U frfcfcttfcSftfc I P Mry MA - Hr^f 7 7 tcfS 

£ fc , t>t5li, I P 7 F 1/ X ^ H f > ARP ( Adress 
Resolution Protocol) , R A R P ( Reverse Adress Resolution 
5 Protocol) (Drtfyhm, !Sfft«t/^yhA»aflSftT*Tt), 

15 x7 (RT, 7-f ;P^iW»7JV=fUXAfc^5) tf*»SnT^*. - 

tti tg 7 7 -r ^ ^ * -)v 2 zmw-fz © T * 3 o 
20 ta 5 a, mnznz r pa^ h&flrj£©*o< a- ft-v 7 

IP/^yhS, £{l7t I P 7 F l/7&tf3feft I P 7 H V 7 Ifi gtj \z ft 
25 I^HMRS^©*!*© I P n*r*> hoo^, ^-cd^Mtc I P 7 H 1/ 7 £ 
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2 6 

buhkbim < A-e^^e u izi& *) iLhtz i p v % 
mwx-fo, -t>-v-5\z, *^v\zmm<D&?izT&«)&fufdi v 

<Do%> IllTtI P7 F UX^|sJ-T, &^iif§ 7C I P T H l/X^L 
ANlC^aSWlOT^S^IP^^y h^t^L, I 

h#K:££n* i P n*rv V tftff s^xco^ft iPTF^oi (d 

nfiLANn:St§IP7^1/X0iT*5) S&ftTS. *LT, 
±E©# I h^TftiJttlLfc^ft IP7F^©#lll:^U ^ 

©IP/^^SP (^-©MtcI P7HI/^OIP/^y H») ^ 5>. 
ttfcStl P7^X©*tl-©**I P7HU7HL, S.OTCP 

h&rt*i?rJ£* (0!*.fcf2Offl) citfci^t; 
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p ® ii {f te I P7 FUXOlf (J^T> :n^r-^^Il 

H 1/*#L AN 1 fclJRS&V^T© I P A^y hPfcttLJK&frfrns. 

I PA dry h cDfla^c^^ > htSi^iitfe^, 
SUtTG IPTHl/X^R-T, JL^, §£i£f@ tg I P7 F l/X^L AN 1 

m^B#^F^tcm#^nfe i p /i^y h©w&:&£> hr^>o tit, 

-fe>1t 5 £fj 1 ft 

f v-x tn-^mmit i prpu^fttts i p a^ ^lanii: 

L AN 1 ^©iiA^Baitf 5. £ftfc<J:D> ^-hX^t>©S?^b 

L AN 1 MS^ns. 
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i-, jfct4^6nfci i a«»*«x-^ i s^tttar- 

^*it>n-5^&ss4A6nntf, e> tmrnfemm (5# 

h CD L A N 1 ^<D51A£&lt-r5<fc'5 £7 7-f 2 £MfflJT5o 
lot, fX^t >©:§fe***IH£V>Tt>3lfi& , ^-©m^f^IPTF 
WX^OD I PXfry htt, LANlCIAtS^ititt^:^ b 

H 1 S&W&fclx A &nfc#> ^CDfg 1 
^0x-^©ii{f7C I P7F1/X*^(Z) I P/^y h©L AN 1 ^(DilA 

% 2 <Dmm<Di%m (Syn-f 1 o o d ) (D&ft&m €r^T 5 . 
^©ilTit -fe^Ste, I P 7 F I P A'^r 

yhS©^, LANlCit5^IP7HI/^0#IP/^-;hS 
L . & I P/^^ h iff t ^ £ tl 3 S y n ffl I H £ © 8t & 

NF*JJKtJE^Jftffl-r*. ^tT, SitHUfc*SyniIP/tiryh©IR 
ftl$*!ja>e>ffi£l$K (fllfctf 2g>IW) fttJSftSnfcSynffllP/^ 
yhiJJ, ^D*ifeIP7HI/^OIP/^f M¥rtfc#£T 

ftKJflEiil/fcSynE I P A'^r ^ h £^S6 T ^-tl £> © SynffllP/^ 

y v^m^^ts^y set, ^cd^j ^ > b bfc^n^n© s y 

nffllP/^^CMLT, ^n^6ft\zttfotZ> A c kffllP/^yb 
(IKBiSynffl I P/^7 h £ PI-OaifsjG I PTFUX&^L. 
& o , iSynffl I P A -X y MDTCPA^ if P©y-^>XSfO* 
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y nm i vn*rv h<DW&mmftib±mmmnffl (2®m) 

^rcii, *©«sg, ±f3M^>b3££ rij ^ofc^a-e-a. 

5 fcfcWfc, ^T5Ac kffl I P/^y MDff«E*i^»bofcttC 
±fB(D#^> hStfffijfcSfc <0»J*.«1 6i@) K±tl?)l^l;tt> S y 
n - f 1 o o d<0#*#fc£nTt>5 Il££ifeftU, ^©Ct&itr 
£, ZL®:giC*i&«tftftl£*lfc SynffllP/^-y b ©Si fix I P 7 b 

zw&vfcmWtfftft I P7Fl/X/i^-t, JL^ft3fc$fc I P7 b 1/ 
X^LAN lCMt^iT© I Prtiry bWlz]tfLT}mfrftt>ft%> 

n - f 1 o o d £&*D l/fc^i, ^©<fc5^1Itct:DSyn-f 1 oo 
15 d £&*0T£ J: 5 13 life tab*. SUBtc I P7h*I/X*^- 

I P7 h*l/7*»L AN 1 !:St5S I P/^y h»t 
#L, ft I P/^f Hft^SniS y n/Ac kffl I P/^*; 
CO^^B#^JJllI^)i^fflajr^ 0 ^bt» rttlibfc^Syn/Ackll 

20 yn/AckfflIP/^7h^> I P 7 F 1/7© I P/^y 

Mf^C#ftt§^S^i<5 0 dcoi#, tCj;5»Syn/Ack 
ffl I P/^y b3&«#ffi-rS«^K:ti, ft^ftLfcS y n/Ac kffl I 
P/^ y h^^{5t^tl6©Syn/Ac kffl I P^dry h©it^* 
r)>ht§. 3 5 Id, f©*0>Mfc^nfn©Syn/AckfflI 

25 htf IT, ^Syn/Ac kffl I PA'^r^ b tf> lift tc I P7 

b UX t!wl-©^5fe I P X b I P K*rv bUZm^Z* Z<D£% 
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3 0 

|Syn/AckiIP/t^^ t:MT§Ac kffl I P ntr y h Cf¥ 
KttRSyn/AckffllP/^y hO^Mf tc I P7h'l/7tR-0 
^IPTF^X^fU, «Syn/AckfflIP;^^CT 
c P y\ y Af^oty-tr >x#^CD^C0A c k#^^l"t5A ckfflIP 
r\>r*jV) T'SoT, I^gSyn/AckffllPAiryhOim 

^6±BBm^^r^ ( 2 Tsfl ) ^td®#$nfcfeo*«» ^tip/^^ 

Sfrtt#fiT5d^^£W<*. -t 1/ T , f ©i^iAc kffi/^yh 
5 -^^^ ±fB©*f <7> h$t£ rij ■3'Oto'J>iE 
it£ 0 fit, JRKSfWt:, fcfJft-fSA ckfflIP/^y b<7)?f&£i$^ 

i^CIt Syn-f lood ©«*#fc3 ttT^ S £ 2: SfcfclTS. 

n - f 1 o o d C^i^taifclt^Str-^ ±I2S y n/A 
c kffl I P/^y h©ii§7C I P7 H^XClf-^^^^^ I P7 F 
l/X©ir-^t$§. CC7)±i^> Syn/AckffllP/^yhOS 
if jc I P 7 H I P 7 h* l^XClf-^ *n 

5fetC^HJbfctfiSSm 2l$^7-^i:^W5 S ynfflIP/1 
<ir y h^^fe 1P7F UXtDm^-f , minTL I P 7 K U 7. (Di$. : f— 9 \Z 

|y!Ef^^^6H, MH2@Ij{^^^T r -^IC^Sn^iilf K I P7 
K 1/X iPi-COigif 7C I P7 h*U7£tt§ I P/tT7 h#L AN 1 C 

I P7 h' 1/X$f I P/t77h^LANl \zmA-?Z>(D%%l 
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fc^SEfrSftlSB <tt*.tt28>W) fijkT Z> i 5 fc 7 7 < * V * -)V 2 <D 

±mmm^ i pt Ku^stts i k ^s^te-hiE^st i p 

7Kl/^Stt5 I h J&W > ? - * y h 3 <b mm £ tlT < § 

5 t, ^0IP/^7^Sib> LANl ^©itA^HihTS. unic 
J;D, Syn-floo dC^HAN lWSn5t*t, - 

fcfc, hX*^ >(&fcailS®tt££IPU3L ^1^*6 ft, i§2 

10 tt«*tt»x-^fc*5^<E»3lfll7c I P7H!/7^ft5I P ft try h<D 
JMftfcfc*±IBffij£l3W <2#|W) 5fefc#J*.5 

SfcW&flx-* CD3§fg% I P7FI/7^6©I P/t^ry h © L AN 1 ^ 
15 ©iiXSIfiih*r 5ck'5lc:77<ir^^-^2 §iIWt5, ^^tlt 
|2ltl«af-^i:^^^E^ I P7 Fl^x^f t§ I P/^-y h 
OSP^tO^Tfel^^T^S. fi£oT, S y n - f 1 ood©!S[*^« 
^TViSKO , £^£iiHs7E I P 7 F l/X^ 6>© I P/1^>y K 

^^^ttfO^Slli^^S I P7F1/XM0I P/^y htt, LAN 

i2ltltar"^t*^^^^I P7 I Y ft try V 

oi^to^tnua^Tfc, ^n-^nc^js-f §±ism^p#r B i (2^ 

M, 2g>M) fflrl2$&2ffi#*&fcI5 i -*tf#*.£* , l 
25 fcjfct>fc«£fcfc^ fOS 2 ia*ttax-^Oiil5c I P 7 H 1/^ * 
WtSIPA^ryh, fc£^fcU ®21^S^7"^«^it I P7 F 
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3 2 

V7, ^tt^ I P V V <D L AN 1 ^£>ilA£>|5!±£MI&T5o 

iH 3 (Teardrop) <Z)$r&lMS£ £tT 5 o 

ClOSaaTtt, -fe>-tf- 5 I P 7 F UXtfEI-T&S I PA<^ 

„hg(D5^ LAN1 KURTSaSite I P 7 h* V X O £ I P n 1 y b » 

u ft i p n>ry bB\z%%n%ttmi*nrz. i p/^>y h car, 
Ait, &«3fciftffl-r«. -©^> iPTtt, # 

g/tery ha, ^oipa^ <d&j£(D7 y?fi$ r i j t&^t^s 

fcL<», 77^^>b*7-fe-;hiV^n5f-^*« roj £<9 
^ft«tftoTU5. :nCJ:D, hSr^ffiTc: 

km 5 «K:flJi#an> mo, Mi/^^tip^^ 

Safe© (ftt3tBb£#$t/^y b <h|p]~<7)#t§/^y M SE^tt^ 
^yh£!^CIP/^yh$ftK&3^£t8^&o ^(D&o 

(fU^80i) Klt^l»l^t:H Teardrop^tl 
a2nfc#«f/^y h ©i£«7n I P7HPX©iT-^Rtf36jfeI P 7 

£©«);5fc4t!li!#3feft I P7 T* l^S^* I P 7 F V 

itufBxV l/^6!t fufSS y n - f 1 ood 
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3 3 

ar-^iCatnslfiTn I P 7 H l/X t m-omm te I 

I P/\^7 h^LAN 1 IZMA-? %Q> 1ft fe&ffi (2 ft 
m) R&lkT £ £5 Iff IE 7 T< ^tJit-yV 2 (D7 4 7 -f & 

7. ^-©^ft I P7H1/X*ft5 I P/^7 h#L AN 1 iCilAf 

Ctlt <fc 0 , TeardropOWSLANl # ft II 3*1 5 «h ^ 

±)EO«fc5l:Te a r d r o p ©&*©tfc»igt3i*fT ? fc-fe 5 te. 
&\Z, W, 4 <Dmm<DJkW- (Land) ©^^n^SSrtT 5 „ 

15 y Mif CD 5 £ , LANlCItS^Jtl P7Fl/XO§I P/t^-7 hi 

#e>, fiip/^7hs©faftiP7H u7>tmvm<omm7t i pt f 
u*£=£*t5 i p^T-y h^ffimr^o ssic, *-©&fflL-fc i p a^- 
y h t h i; as 5t i P7 h i/x© i p a- ^ y s m (o * & e , mi p a y v 

V h^Z?k\t% IP7F l^X^tU I^i I P/^7 HomtfBt^J^ 

20 zm^mm (M%.&2ttm) rttt#snfeip/^^f*^«t5* 

S^^P^^o ^bT, © «fc -5 & I P A* y h ifi&tE-t % m & \z \± , 

9c\Z%lftLtzL I h£^#>T^tl6>© I h©il P A^r 

6i) K±T*S»^fctt, L a n d <Z)3fc*3&*fc£ftTV>5 £ 
25 ^ (D Z\ t^Sff-^ <h , :©*»^ftSnft I h0T& 
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3 4 

ZV&Sfcmmftftft I P 7 H IP7FI/ 
AN 1 fciti^TO I P n>ry V W \Z *T b T Jt^fTfr tl £ . 

lufBxV 6 fc£, ^4a^*tt^x-^tC&*nsSlffi7C I P 7 F 

1/7. t fej-CD^MTC I P7 FUXfc^fL, fi^, iif^I 
^-©JfcSfe I P7 Kl/XStt5 I P/1^7 htf LAN 1 £ it AT 3 
Si SEXISM (0!I;U*3#K> ffiJhTS J: 5 tcfifH? 7 -f ^ £ 

2 te, iifBMTU I P 7 F l/X&l^M I P7HVXSft5 I 
P/^*;h*t'f>^-*yh3*6aii3nT<5i:, ^© I PA°^y 
hSJKSSU, LANl'viiDlASEitS. :ni:J;D, Land (D?k 
mfr <o L AN 1 ^&0$tl£ o 

|4|ii(iWT-^ ^^tt^iifiTU I P 7 h* fcE-©Sifc7C I P 
7 K U * & 3fc 5te I P7HI/X^tti) I h <D #ER£ # £ Jif2 

-Hffjeisisi (6^wi) ^iit^st©riii:, ^[c^^^nfe^4^ijj» 

CD jet -fit TU I P7Hl/^R^5fcI P7Hl/7$ttSI P K*r v Y <D L 

an 1 ^cojtA^Plih-r^ck 5 £7 r< -fr^* — 2 sraffl"***. 

T, L a n d 0#*#i|fcUT^ SIS 0 , ffi 5 SlfSTC I P 7 H 

P7Hl/XStt^ I PA'^7 hii, LAN1 tjiX-T 
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I P 7 FVX&t/^ft IP7Hk7tt§IP/^7b©LAN^(D 

PA^ry hcDMffjn I P7 Fl/XOfir-^f^ 1/ ^ 6 
C^^.5«fc5i:bfc^, LandiDSIiCffSIP/^*; h (DBit % I 

7C I P 7 F l/XOlif-^©ftfe 0 IP7h'UX0fi*7^ 

fflSfiOOct'S fc, Land ©i^S©tailS!f ^fct 5 li, & \Z 

r_0MST«, -fe>U-5tt, ^^IP7H1/X*^-T?^5IP/^ 
y hl¥©p^, LANli:Mt5*ftIP7Hl/X0^IP/^yh» 

tlfc I P A^ry hO^if 7C IP7F I/XOIt-^M 

^©ct^^^S^^^ I P7 FUA#M-t?* I^ftSiftlPTFU 
X^LAN 1 tcPf-S^T© I PA^y h^tCMUTJi^fT^nSo 

-fe >-if 5 jfc £t&52B© J; 5 5l^i^^T-^ e>nfc 
tfigBx-f V 1 ? *? 6 te, l£fg 5 S^^^^x-'^co^m tc IP7F 
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u%L% i p t h t^ti^nwi-<omm7t i p t f i/xa^ft r p 

7FI/X^tt5 I M*L AN 1 £}IAT&©£3I£E^ 6P/r£ 

r^l7r-fi^ltli^o ^©<h£, 77-<t^t-^2(l ±IB 
5 £Mf 7C I P7H^7S^I P7 F 1/7, $f I PA^y F#<>*— 
*y F 3 /5^itlf StlT< £ F£M^U LAN 1 

^©£SSj&> HANI 

10 aS^tta^-^ir^lj-SSIfl I P7 Fl'XRtffcSfc I P7 FUX£ 
tt5 I P /Sfry h©S^C«S±!3Hlf3£NfW A««ilt5i 

( i mm), 5 i^iiaT-^oit 7c i p 7 h i/xs^ft i 

15 P7 F l/7SWt5 I P A^ry F©L AN 1 ^ © it A £ BEltT £ «fc 5 K 
77-ft^t-iV2 SfWAfT*. tot, S 5 0«fg0#*#«^T^ 
, f ©ijfiCffSlMTC I P7 Fl/X&^^I P7H!/Xl:t 

^©itlf t£ I P7Fl/XX^5feIP7Hl/X$ftSI P/1^ry F © 
L AN 1 ^©5iA©lfill:£apl$t"a. 

25 "5 o 

lO^STH -k>-y-5ti, I P7 F U7,1fim-T*$>%> I P 
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V hffi<D?%, L AN 1 \Z.m?Z>&ft I P7 Fl^<D& I Prtdry h» 
t^tb, 0!|;U£7*U T 1 p r j ^tb, 7*- 

^IMX^l 2 8£^_tl?&£ I P/t^7 h^tlt^. ^LT, ^ 
<D£-5& I P/t^ry htf&'Ofrifrm&fcte. L A N 1 <D * X h CD X 

PTHI/XClf-^R^ifelPTh'UXOilr-^tS - 
ffJfSxV 6 tt % ttf& 6 a^***^- I P7 Kl/XR 

ip7F i/7 ^^-n-^npi— ©saitc i p 7 h i/xatf^^ i p 

7Fl/X£W1~3 I P/^7 M*LANl£iiA-r£0£3S£Ea>eBfT£ 
MMtc I PT F l/X&tf I P7 Fl/X ^ttS I PA°^7 h*M>^~ 

*y h 3 & zmmtsftT < s i p/iy y hzmmv, L AN 1 
tts i p/^f h©i^i:s5±fi^K (4mm) 

(4l$lffl), ^m6S^^^^x-^CDMm7C I P7HI/7R^ftI 
P7^7*ft5 I P/^^ h CD L A N 1 ^CDit A£|5BlkT& «t "5 
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3 8 

SRgO , ^(DiXmiz^zmMTt I P T H UXRtffcifc I P 7 F 
t5IP/^7hit LANltiAt5ttttT?*aVJ. t X > x 
^^6}t ±fBHfr5tP#Fe1 (4I^W) #ifli&T 3 £T fufBfg 6 S 

'J 7)V^^ ftfllSnfc*»^6LAN IS 

y hy-i'fltiK, # 7 *;jti-l: ( };5S»H«bTLAN 1 
Itfcr), M%\zu ify y b£ 0 t'£##^:MI^CglJii£n> 

£^^T^3:> LAN 1 <D!IJ$^tf>3X h^MtS^i^tS, 

attftaaftfc^ttiaTtt, lan 1 tnsut ©a it s& 

gtt#4>ft<&£. Z\<Dtctb. L AN 1 wajfOS SJt^i^ 

&±.mmLfc.mmmmx\$. LANi©xDPt7T'ft')* 
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misT&<<, ^i/t, a M^bfcB 1 7^sm 6 

lS^Sl7-^OJ;5 ft: If as*? h »7-£ffS#^ffiWg#^© 
h Cr-f 1/^7 ^ 6 £ 3 Utt-fe >it 5 ^ b iifiT^o Z. CD J; -5 fc Lit 

fufBIIM^Tte, tftfc&LfcDoS (Denial of Service) 
^j^-T^i^^cD^^, Syn-flood, Teardrop, Lan 
15 d £^£01"£ L fco {i Smurf^Floo 
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I ^ © i 1 

1. IP (Internet Protocol) < 3H& £fr 5 * y h 7 — £ © A 

2. SJia ?Sc*ttfiI^ Stt, MIB*y h7-£<E>A9 P£iIiat*5£T0> 
10 % 1 ^fBiic©^ "5 ^-HvXtA. 

Ac 

20 < £fe£Uf te I P7 HV^Rtf/Xtt*Jfe I PTFl/Xta^itS 

6. ffflHStSttfc^Ktt, tt*LT«8Lfcttiatt*© I P/1**y 
iC© I P n>Tv hT&oT, 4>ft< £fc-?-0 3H§ 7C I P7 F l/7#5VJ 
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4 1 

CP (Transmission Control Protocol) tl^<It©S y I 
P/^ybT*oT, tb^Ofcfti I P7 HUX^SVifcP-T? 

©£{l7£ I P7Fl/X&tf?&ftI PTHl^XSttStftCIIIBaTCP 
10 Clo'< A c kffl I P/tfry htflJ&IBffifcftlfflrtKJimSftTVifc^ t 

8. fufE#^*n#i£te> MLT«ttL&ffllEtt»0 I P/tfrv 

15 (Transmission Control Protocol) l;l^<IIOSyn/Ac k 
ffllP/^yhTfftoT, 4>fc< £fc^0£Uf7C I PT fl/X^nf 

AckffllP/^^T^T, i!E#Syn/AckfflIP/^7h 

o^iitc i pjki/xs^^i P7F u-x fc-en^nH-o&sfc i p 

20 7 F UX&tfStM 7n I P 7 F ©#^12^1$$ 

9. tuE#«i&£n¥&te, sfibTft»ufciiaa*© i ho 
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4 2 

li. HfiiB£S&*i]^gm, ifc#LT«J#bfciiul2*I&0) i P n*rv V 

77- \ttfMK\zmtjLZh<Dlftmfe&&>±&Z>t%* W> 5 CD fl IK CD fu IB 
VB4K © £ v v % -> X t- A . 

1 2 . tME#«mftl¥gm, I&t#LT^&LfcfjfB*I$CCD I ?i\>ry V 
CD ? , yty7 7t-A7D-tf fcn5t^aUf>f ^--l^«*t 

gfct-rsil ^©lafflm 1 JifB*£cD ^ y ^-g|SyXf^ 0 

13. fuSBM^^f? dBSte, Ifif3^*^^^^n7cg^^-riga 

14. atfMg^&tffr aiiit BuSB^^^^a^^^^^LfefifBi^ 

5 I P/^y h CD 1513^^ h7 — #^<Z)iiA£, IS IB & ^ £ & £H UTfr 
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4 3 

<D p ? v ts — -> X -r A 0 
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